ruvnet/RuView · error · HTTPException

Admin privileges required

Error message

Admin privileges required

What it means

get_admin_user raises 403 'Admin privileges required' when the authenticated active user lacks is_admin=True. It chains through get_current_active_user, so it only fires after authentication already succeeded — it is a role check, not an authentication failure.

Source

Thrown at archive/v1/src/api/dependencies.py:138

            headers={"WWW-Authenticate": "Bearer"},
        )
    
    # Check if user is active
    if not current_user.get("is_active", True):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Inactive user"
        )
    
    return current_user


async def get_admin_user(
    current_user: Dict[str, Any] = Depends(get_current_active_user)
) -> Dict[str, Any]:
    """Get current admin user (admin privileges required)."""
    if not current_user.get("is_admin", False):
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="Admin privileges required"
        )
    
    return current_user


# Permission dependencies
def require_permission(permission: str):
    """Dependency factory for permission checking."""
    
    async def check_permission(
        current_user: Dict[str, Any] = Depends(get_current_active_user)
    ) -> Dict[str, Any]:
        """Check if user has required permission."""
        user_permissions = current_user.get("permissions", [])
        
        # Admin users have all permissions

View on GitHub (pinned to 4685618388)

Solutions

1. Authenticate as an account with is_admin=True and retry
2. Grant is_admin to the account (admin console or DB update) and log in again
3. Verify the token issuer actually includes the admin claim your API checks

# Check the admin claim before calling admin endpoints
claims = jwt.decode(token, options={'verify_signature': False})
if not claims.get('is_admin', False):
    raise PermissionError('This operation requires an admin token')
client.get('/api/admin/users', headers={'Authorization': f'Bearer {token}'})

try:
    r = client.get('/api/admin/users', headers=auth)
    r.raise_for_status()
except httpx.HTTPStatusError as e:
    if e.response.status_code == 403:
        # role problem, not session problem: hide admin UI, do not retry with same token
        disable_admin_ui()
    raise

When it happens

Trigger: A regular user's token used on an admin-only route; a JWT minted without the admin claim; the admin flag removed from the user record while their token remains valid.

Common situations: Calling admin endpoints with a normal login; role changes not reflected until the token is re-issued; scripts or tools configured with the wrong credentials.

Related errors

• Inactive user
• Permission '{permission}' required
• Access denied to zone '{zone_id}'
• Access denied to router '{router_id}'
• Not enough permissions. Required scope: {scope}

AI-assisted analysis of ruvnet/RuView@4685618388 (2026-08-16). Data as JSON: /api/errors/b519981d654d2b97. Report an issue: GitHub.